--- /dev/null
+From d5ce4c31d6df518dd8f63bbae20d7423c5018a6c Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Mon, 16 Oct 2017 15:59:10 +0200
+Subject: block: cope with WRITE ZEROES failing in blkdev_issue_zeroout()
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit d5ce4c31d6df518dd8f63bbae20d7423c5018a6c upstream.
+
+sd_config_write_same() ignores ->max_ws_blocks == 0 and resets it to
+permit trying WRITE SAME on older SCSI devices, unless ->no_write_same
+is set. Because REQ_OP_WRITE_ZEROES is implemented in terms of WRITE
+SAME, blkdev_issue_zeroout() may fail with -EREMOTEIO:
+
+ $ fallocate -zn -l 1k /dev/sdg
+ fallocate: fallocate failed: Remote I/O error
+ $ fallocate -zn -l 1k /dev/sdg # OK
+ $ fallocate -zn -l 1k /dev/sdg # OK
+
+The following calls succeed because sd_done() sets ->no_write_same in
+response to a sense that would become BLK_STS_TARGET/-EREMOTEIO, causing
+__blkdev_issue_zeroout() to fall back to generating ZERO_PAGE bios.
+
+This means blkdev_issue_zeroout() must cope with WRITE ZEROES failing
+and fall back to manually zeroing, unless BLKDEV_ZERO_NOFALLBACK is
+specified. For BLKDEV_ZERO_NOFALLBACK case, return -EOPNOTSUPP if
+sd_done() has just set ->no_write_same thus indicating lack of offload
+support.
+
+Fixes: c20cfc27a473 ("block: stop using blkdev_issue_write_same for zeroing")
+Cc: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Janne Huttunen <janne.huttunen@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-lib.c | 45 +++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 35 insertions(+), 10 deletions(-)
+
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -322,12 +322,6 @@ static int __blkdev_issue_zero_pages(str
+ * Zero-fill a block range, either using hardware offload or by explicitly
+ * writing zeroes to the device.
+ *
+- * Note that this function may fail with -EOPNOTSUPP if the driver signals
+- * zeroing offload support, but the device fails to process the command (for
+- * some devices there is no non-destructive way to verify whether this
+- * operation is actually supported). In this case the caller should call
+- * retry the call to blkdev_issue_zeroout() and the fallback path will be used.
+- *
+ * If a device is using logical block provisioning, the underlying space will
+ * not be released if %flags contains BLKDEV_ZERO_NOUNMAP.
+ *
+@@ -371,18 +365,49 @@ EXPORT_SYMBOL(__blkdev_issue_zeroout);
+ int blkdev_issue_zeroout(struct block_device *bdev, sector_t sector,
+ sector_t nr_sects, gfp_t gfp_mask, unsigned flags)
+ {
+- int ret;
+- struct bio *bio = NULL;
++ int ret = 0;
++ sector_t bs_mask;
++ struct bio *bio;
+ struct blk_plug plug;
++ bool try_write_zeroes = !!bdev_write_zeroes_sectors(bdev);
+
++ bs_mask = (bdev_logical_block_size(bdev) >> 9) - 1;
++ if ((sector | nr_sects) & bs_mask)
++ return -EINVAL;
++
++retry:
++ bio = NULL;
+ blk_start_plug(&plug);
+- ret = __blkdev_issue_zeroout(bdev, sector, nr_sects, gfp_mask,
+- &bio, flags);
++ if (try_write_zeroes) {
++ ret = __blkdev_issue_write_zeroes(bdev, sector, nr_sects,
++ gfp_mask, &bio, flags);
++ } else if (!(flags & BLKDEV_ZERO_NOFALLBACK)) {
++ ret = __blkdev_issue_zero_pages(bdev, sector, nr_sects,
++ gfp_mask, &bio);
++ } else {
++ /* No zeroing offload support */
++ ret = -EOPNOTSUPP;
++ }
+ if (ret == 0 && bio) {
+ ret = submit_bio_wait(bio);
+ bio_put(bio);
+ }
+ blk_finish_plug(&plug);
++ if (ret && try_write_zeroes) {
++ if (!(flags & BLKDEV_ZERO_NOFALLBACK)) {
++ try_write_zeroes = false;
++ goto retry;
++ }
++ if (!bdev_write_zeroes_sectors(bdev)) {
++ /*
++ * Zeroing offload support was indicated, but the
++ * device reported ILLEGAL REQUEST (for some devices
++ * there is no non-destructive way to verify whether
++ * WRITE ZEROES is actually supported).
++ */
++ ret = -EOPNOTSUPP;
++ }
++ }
+
+ return ret;
+ }
--- /dev/null
+From 425a4dba7953e35ffd096771973add6d2f40d2ed Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Mon, 16 Oct 2017 15:59:09 +0200
+Subject: block: factor out __blkdev_issue_zero_pages()
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 425a4dba7953e35ffd096771973add6d2f40d2ed upstream.
+
+blkdev_issue_zeroout() will use this in !BLKDEV_ZERO_NOFALLBACK case.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Janne Huttunen <janne.huttunen@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-lib.c | 63 ++++++++++++++++++++++++++++++++------------------------
+ 1 file changed, 37 insertions(+), 26 deletions(-)
+
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -275,6 +275,40 @@ static unsigned int __blkdev_sectors_to_
+ return min(pages, (sector_t)BIO_MAX_PAGES);
+ }
+
++static int __blkdev_issue_zero_pages(struct block_device *bdev,
++ sector_t sector, sector_t nr_sects, gfp_t gfp_mask,
++ struct bio **biop)
++{
++ struct request_queue *q = bdev_get_queue(bdev);
++ struct bio *bio = *biop;
++ int bi_size = 0;
++ unsigned int sz;
++
++ if (!q)
++ return -ENXIO;
++
++ while (nr_sects != 0) {
++ bio = next_bio(bio, __blkdev_sectors_to_bio_pages(nr_sects),
++ gfp_mask);
++ bio->bi_iter.bi_sector = sector;
++ bio_set_dev(bio, bdev);
++ bio_set_op_attrs(bio, REQ_OP_WRITE, 0);
++
++ while (nr_sects != 0) {
++ sz = min((sector_t) PAGE_SIZE, nr_sects << 9);
++ bi_size = bio_add_page(bio, ZERO_PAGE(0), sz, 0);
++ nr_sects -= bi_size >> 9;
++ sector += bi_size >> 9;
++ if (bi_size < sz)
++ break;
++ }
++ cond_resched();
++ }
++
++ *biop = bio;
++ return 0;
++}
++
+ /**
+ * __blkdev_issue_zeroout - generate number of zero filed write bios
+ * @bdev: blockdev to issue
+@@ -305,9 +339,6 @@ int __blkdev_issue_zeroout(struct block_
+ unsigned flags)
+ {
+ int ret;
+- int bi_size = 0;
+- struct bio *bio = *biop;
+- unsigned int sz;
+ sector_t bs_mask;
+
+ bs_mask = (bdev_logical_block_size(bdev) >> 9) - 1;
+@@ -317,30 +348,10 @@ int __blkdev_issue_zeroout(struct block_
+ ret = __blkdev_issue_write_zeroes(bdev, sector, nr_sects, gfp_mask,
+ biop, flags);
+ if (ret != -EOPNOTSUPP || (flags & BLKDEV_ZERO_NOFALLBACK))
+- goto out;
+-
+- ret = 0;
+- while (nr_sects != 0) {
+- bio = next_bio(bio, __blkdev_sectors_to_bio_pages(nr_sects),
+- gfp_mask);
+- bio->bi_iter.bi_sector = sector;
+- bio_set_dev(bio, bdev);
+- bio_set_op_attrs(bio, REQ_OP_WRITE, 0);
++ return ret;
+
+- while (nr_sects != 0) {
+- sz = min((sector_t) PAGE_SIZE, nr_sects << 9);
+- bi_size = bio_add_page(bio, ZERO_PAGE(0), sz, 0);
+- nr_sects -= bi_size >> 9;
+- sector += bi_size >> 9;
+- if (bi_size < sz)
+- break;
+- }
+- cond_resched();
+- }
+-
+- *biop = bio;
+-out:
+- return ret;
++ return __blkdev_issue_zero_pages(bdev, sector, nr_sects, gfp_mask,
++ biop);
+ }
+ EXPORT_SYMBOL(__blkdev_issue_zeroout);
+
--- /dev/null
+From 80660f20252d6f76c9f203874ad7c7a4a8508cf8 Mon Sep 17 00:00:00 2001
+From: Dave Jiang <dave.jiang@intel.com>
+Date: Wed, 30 May 2018 13:03:46 -0700
+Subject: dax: change bdev_dax_supported() to support boolean returns
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+commit 80660f20252d6f76c9f203874ad7c7a4a8508cf8 upstream.
+
+The function return values are confusing with the way the function is
+named. We expect a true or false return value but it actually returns
+0/-errno. This makes the code very confusing. Changing the return values
+to return a bool where if DAX is supported then return true and no DAX
+support returns false.
+
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/dax/super.c | 14 +++++++-------
+ fs/ext2/super.c | 3 +--
+ fs/ext4/super.c | 3 +--
+ fs/xfs/xfs_ioctl.c | 4 ++--
+ fs/xfs/xfs_super.c | 12 ++++++------
+ include/linux/dax.h | 8 ++++----
+ 6 files changed, 21 insertions(+), 23 deletions(-)
+
+--- a/drivers/dax/super.c
++++ b/drivers/dax/super.c
+@@ -79,9 +79,9 @@ EXPORT_SYMBOL_GPL(fs_dax_get_by_bdev);
+ * This is a library function for filesystems to check if the block device
+ * can be mounted with dax option.
+ *
+- * Return: negative errno if unsupported, 0 if supported.
++ * Return: true if supported, false if unsupported
+ */
+-int __bdev_dax_supported(struct block_device *bdev, int blocksize)
++bool __bdev_dax_supported(struct block_device *bdev, int blocksize)
+ {
+ struct dax_device *dax_dev;
+ pgoff_t pgoff;
+@@ -94,21 +94,21 @@ int __bdev_dax_supported(struct block_de
+ if (blocksize != PAGE_SIZE) {
+ pr_debug("%s: error: unsupported blocksize for dax\n",
+ bdevname(bdev, buf));
+- return -EINVAL;
++ return false;
+ }
+
+ err = bdev_dax_pgoff(bdev, 0, PAGE_SIZE, &pgoff);
+ if (err) {
+ pr_debug("%s: error: unaligned partition for dax\n",
+ bdevname(bdev, buf));
+- return err;
++ return false;
+ }
+
+ dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+ if (!dax_dev) {
+ pr_debug("%s: error: device does not support dax\n",
+ bdevname(bdev, buf));
+- return -EOPNOTSUPP;
++ return false;
+ }
+
+ id = dax_read_lock();
+@@ -120,10 +120,10 @@ int __bdev_dax_supported(struct block_de
+ if (len < 1) {
+ pr_debug("%s: error: dax access failed (%ld)\n",
+ bdevname(bdev, buf), len);
+- return len < 0 ? len : -EIO;
++ return false;
+ }
+
+- return 0;
++ return true;
+ }
+ EXPORT_SYMBOL_GPL(__bdev_dax_supported);
+ #endif
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -953,8 +953,7 @@ static int ext2_fill_super(struct super_
+ blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);
+
+ if (sbi->s_mount_opt & EXT2_MOUNT_DAX) {
+- err = bdev_dax_supported(sb->s_bdev, blocksize);
+- if (err)
++ if (!bdev_dax_supported(sb->s_bdev, blocksize))
+ goto failed_mount;
+ }
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3770,8 +3770,7 @@ static int ext4_fill_super(struct super_
+ " that may contain inline data");
+ goto failed_mount;
+ }
+- err = bdev_dax_supported(sb->s_bdev, blocksize);
+- if (err)
++ if (!bdev_dax_supported(sb->s_bdev, blocksize))
+ goto failed_mount;
+ }
+
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -1101,8 +1101,8 @@ xfs_ioctl_setattr_dax_invalidate(
+ if (fa->fsx_xflags & FS_XFLAG_DAX) {
+ if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)))
+ return -EINVAL;
+- if (bdev_dax_supported(xfs_find_bdev_for_inode(VFS_I(ip)),
+- sb->s_blocksize) < 0)
++ if (!bdev_dax_supported(xfs_find_bdev_for_inode(VFS_I(ip)),
++ sb->s_blocksize))
+ return -EINVAL;
+ }
+
+--- a/fs/xfs/xfs_super.c
++++ b/fs/xfs/xfs_super.c
+@@ -1640,17 +1640,17 @@ xfs_fs_fill_super(
+ sb->s_flags |= SB_I_VERSION;
+
+ if (mp->m_flags & XFS_MOUNT_DAX) {
+- int error2 = 0;
++ bool rtdev_is_dax = false, datadev_is_dax;
+
+ xfs_warn(mp,
+ "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
+
+- error = bdev_dax_supported(mp->m_ddev_targp->bt_bdev,
+- sb->s_blocksize);
++ datadev_is_dax = bdev_dax_supported(mp->m_ddev_targp->bt_bdev,
++ sb->s_blocksize);
+ if (mp->m_rtdev_targp)
+- error2 = bdev_dax_supported(mp->m_rtdev_targp->bt_bdev,
+- sb->s_blocksize);
+- if (error && error2) {
++ rtdev_is_dax = bdev_dax_supported(
++ mp->m_rtdev_targp->bt_bdev, sb->s_blocksize);
++ if (!rtdev_is_dax && !datadev_is_dax) {
+ xfs_alert(mp,
+ "DAX unsupported by block device. Turning off DAX.");
+ mp->m_flags &= ~XFS_MOUNT_DAX;
+--- a/include/linux/dax.h
++++ b/include/linux/dax.h
+@@ -40,8 +40,8 @@ static inline void put_dax(struct dax_de
+
+ int bdev_dax_pgoff(struct block_device *, sector_t, size_t, pgoff_t *pgoff);
+ #if IS_ENABLED(CONFIG_FS_DAX)
+-int __bdev_dax_supported(struct block_device *bdev, int blocksize);
+-static inline int bdev_dax_supported(struct block_device *bdev, int blocksize)
++bool __bdev_dax_supported(struct block_device *bdev, int blocksize);
++static inline bool bdev_dax_supported(struct block_device *bdev, int blocksize)
+ {
+ return __bdev_dax_supported(bdev, blocksize);
+ }
+@@ -58,10 +58,10 @@ static inline void fs_put_dax(struct dax
+
+ struct dax_device *fs_dax_get_by_bdev(struct block_device *bdev);
+ #else
+-static inline int bdev_dax_supported(struct block_device *bdev,
++static inline bool bdev_dax_supported(struct block_device *bdev,
+ int blocksize)
+ {
+- return -EOPNOTSUPP;
++ return false;
+ }
+
+ static inline struct dax_device *fs_dax_get_by_host(const char *host)
--- /dev/null
+From 15256f6cc4b44f2e70503758150267fd2a53c0d6 Mon Sep 17 00:00:00 2001
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+Date: Tue, 26 Jun 2018 16:30:40 -0600
+Subject: dax: check for QUEUE_FLAG_DAX in bdev_dax_supported()
+
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+
+commit 15256f6cc4b44f2e70503758150267fd2a53c0d6 upstream.
+
+Add an explicit check for QUEUE_FLAG_DAX to __bdev_dax_supported(). This
+is needed for DM configurations where the first element in the dm-linear or
+dm-stripe target supports DAX, but other elements do not. Without this
+check __bdev_dax_supported() will pass for such devices, letting a
+filesystem on that device mount with the DAX option.
+
+Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Suggested-by: Mike Snitzer <snitzer@redhat.com>
+Fixes: commit 545ed20e6df6 ("dm: add infrastructure for DAX support")
+Cc: stable@vger.kernel.org
+Acked-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/dax/super.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/dax/super.c
++++ b/drivers/dax/super.c
+@@ -84,6 +84,7 @@ EXPORT_SYMBOL_GPL(fs_dax_get_by_bdev);
+ bool __bdev_dax_supported(struct block_device *bdev, int blocksize)
+ {
+ struct dax_device *dax_dev;
++ struct request_queue *q;
+ pgoff_t pgoff;
+ int err, id;
+ void *kaddr;
+@@ -96,6 +97,13 @@ bool __bdev_dax_supported(struct block_d
+ bdevname(bdev, buf));
+ return false;
+ }
++
++ q = bdev_get_queue(bdev);
++ if (!q || !blk_queue_dax(q)) {
++ pr_debug("%s: error: request queue doesn't support dax\n",
++ bdevname(bdev, buf));
++ return false;
++ }
+
+ err = bdev_dax_pgoff(bdev, 0, PAGE_SIZE, &pgoff);
+ if (err) {
--- /dev/null
+From dbc626597c39b24cefce09fbd8e9dea85869a801 Mon Sep 17 00:00:00 2001
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+Date: Tue, 26 Jun 2018 16:30:41 -0600
+Subject: dm: prevent DAX mounts if not supported
+
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+
+commit dbc626597c39b24cefce09fbd8e9dea85869a801 upstream.
+
+Currently device_supports_dax() just checks to see if the QUEUE_FLAG_DAX
+flag is set on the device's request queue to decide whether or not the
+device supports filesystem DAX. Really we should be using
+bdev_dax_supported() like filesystems do at mount time. This performs
+other tests like checking to make sure the dax_direct_access() path works.
+
+We also explicitly clear QUEUE_FLAG_DAX on the DM device's request queue if
+any of the underlying devices do not support DAX. This makes the handling
+of QUEUE_FLAG_DAX consistent with the setting/clearing of most other flags
+in dm_table_set_restrictions().
+
+Now that bdev_dax_supported() explicitly checks for QUEUE_FLAG_DAX, this
+will ensure that filesystems built upon DM devices will only be able to
+mount with DAX if all underlying devices also support DAX.
+
+Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Fixes: commit 545ed20e6df6 ("dm: add infrastructure for DAX support")
+Cc: stable@vger.kernel.org
+Acked-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-table.c | 7 ++++---
+ drivers/md/dm.c | 3 +--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -883,9 +883,7 @@ EXPORT_SYMBOL_GPL(dm_table_set_type);
+ static int device_supports_dax(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
+ {
+- struct request_queue *q = bdev_get_queue(dev->bdev);
+-
+- return q && blk_queue_dax(q);
++ return bdev_dax_supported(dev->bdev, PAGE_SIZE);
+ }
+
+ static bool dm_table_supports_dax(struct dm_table *t)
+@@ -1815,6 +1813,9 @@ void dm_table_set_restrictions(struct dm
+
+ if (dm_table_supports_dax(t))
+ queue_flag_set_unlocked(QUEUE_FLAG_DAX, q);
++ else
++ queue_flag_clear_unlocked(QUEUE_FLAG_DAX, q);
++
+ if (dm_table_supports_dax_write_cache(t))
+ dax_write_cache(t->md->dax_dev, true);
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -961,8 +961,7 @@ static long dm_dax_direct_access(struct
+ if (len < 1)
+ goto out;
+ nr_pages = min(len, nr_pages);
+- if (ti->type->direct_access)
+- ret = ti->type->direct_access(ti, pgoff, nr_pages, kaddr, pfn);
++ ret = ti->type->direct_access(ti, pgoff, nr_pages, kaddr, pfn);
+
+ out:
+ dm_put_live_table(md, srcu_idx);
--- /dev/null
+From ad3793fc3945173f64d82d05d3ecde41f6c0435c Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Mon, 4 Dec 2017 23:28:32 -0500
+Subject: dm: set QUEUE_FLAG_DAX accordingly in dm_table_set_restrictions()
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit ad3793fc3945173f64d82d05d3ecde41f6c0435c upstream.
+
+Rather than having DAX support be unique by setting it based on table
+type in dm_setup_md_queue().
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-table.c | 2 ++
+ drivers/md/dm.c | 3 ---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1813,6 +1813,8 @@ void dm_table_set_restrictions(struct dm
+ }
+ blk_queue_write_cache(q, wc, fua);
+
++ if (dm_table_supports_dax(t))
++ queue_flag_set_unlocked(QUEUE_FLAG_DAX, q);
+ if (dm_table_supports_dax_write_cache(t))
+ dax_write_cache(t->md->dax_dev, true);
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2050,9 +2050,6 @@ int dm_setup_md_queue(struct mapped_devi
+ */
+ bioset_free(md->queue->bio_split);
+ md->queue->bio_split = NULL;
+-
+- if (type == DM_TYPE_DAX_BIO_BASED)
+- queue_flag_set_unlocked(QUEUE_FLAG_DAX, md->queue);
+ break;
+ case DM_TYPE_NONE:
+ WARN_ON_ONCE(true);
--- /dev/null
+From dc7a10ddee0c56c6d891dd18de5c4ee9869545e0 Mon Sep 17 00:00:00 2001
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+Date: Fri, 30 Mar 2018 17:58:13 -0700
+Subject: f2fs: truncate preallocated blocks in error case
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+commit dc7a10ddee0c56c6d891dd18de5c4ee9869545e0 upstream.
+
+If write is failed, we must deallocate the blocks that we couldn't write.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2694,11 +2694,16 @@ static ssize_t f2fs_file_write_iter(stru
+ inode_lock(inode);
+ ret = generic_write_checks(iocb, from);
+ if (ret > 0) {
++ bool preallocated = false;
++ size_t target_size = 0;
+ int err;
+
+ if (iov_iter_fault_in_readable(from, iov_iter_count(from)))
+ set_inode_flag(inode, FI_NO_PREALLOC);
+
++ preallocated = true;
++ target_size = iocb->ki_pos + iov_iter_count(from);
++
+ err = f2fs_preallocate_blocks(iocb, from);
+ if (err) {
+ clear_inode_flag(inode, FI_NO_PREALLOC);
+@@ -2710,6 +2715,10 @@ static ssize_t f2fs_file_write_iter(stru
+ blk_finish_plug(&plug);
+ clear_inode_flag(inode, FI_NO_PREALLOC);
+
++ /* if we couldn't write data, we should deallocate blocks. */
++ if (preallocated && i_size_read(inode) < target_size)
++ f2fs_truncate(inode);
++
+ if (ret > 0)
+ f2fs_update_iostat(F2FS_I_SB(inode), APP_WRITE_IO, ret);
+ }
--- /dev/null
+From ba23cba9b3bdc967aabdc6ff1e3e9b11ce05bb4f Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Wed, 30 May 2018 13:03:45 -0700
+Subject: fs: allow per-device dax status checking for filesystems
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+commit ba23cba9b3bdc967aabdc6ff1e3e9b11ce05bb4f upstream.
+
+Change bdev_dax_supported so it takes a bdev parameter. This enables
+multi-device filesystems like xfs to check that a dax device can work for
+the particular filesystem. Once that's in place, actually fix all the
+parts of XFS where we need to be able to distinguish between datadev and
+rtdev.
+
+This patch fixes the problem where we screw up the dax support checking
+in xfs if the datadev and rtdev have different dax capabilities.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+[rez: Re-added __bdev_dax_supported() for !CONFIG_FS_DAX cases]
+Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dax/super.c | 22 +++++++++++-----------
+ fs/ext2/super.c | 2 +-
+ fs/ext4/super.c | 2 +-
+ fs/xfs/xfs_ioctl.c | 3 ++-
+ fs/xfs/xfs_iops.c | 30 +++++++++++++++++++++++++-----
+ fs/xfs/xfs_super.c | 10 ++++++++--
+ include/linux/dax.h | 9 +++++----
+ 7 files changed, 53 insertions(+), 25 deletions(-)
+
+--- a/drivers/dax/super.c
++++ b/drivers/dax/super.c
+@@ -73,7 +73,7 @@ EXPORT_SYMBOL_GPL(fs_dax_get_by_bdev);
+
+ /**
+ * __bdev_dax_supported() - Check if the device supports dax for filesystem
+- * @sb: The superblock of the device
++ * @bdev: block device to check
+ * @blocksize: The block size of the device
+ *
+ * This is a library function for filesystems to check if the block device
+@@ -81,33 +81,33 @@ EXPORT_SYMBOL_GPL(fs_dax_get_by_bdev);
+ *
+ * Return: negative errno if unsupported, 0 if supported.
+ */
+-int __bdev_dax_supported(struct super_block *sb, int blocksize)
++int __bdev_dax_supported(struct block_device *bdev, int blocksize)
+ {
+- struct block_device *bdev = sb->s_bdev;
+ struct dax_device *dax_dev;
+ pgoff_t pgoff;
+ int err, id;
+ void *kaddr;
+ pfn_t pfn;
+ long len;
++ char buf[BDEVNAME_SIZE];
+
+ if (blocksize != PAGE_SIZE) {
+- pr_err("VFS (%s): error: unsupported blocksize for dax\n",
+- sb->s_id);
++ pr_debug("%s: error: unsupported blocksize for dax\n",
++ bdevname(bdev, buf));
+ return -EINVAL;
+ }
+
+ err = bdev_dax_pgoff(bdev, 0, PAGE_SIZE, &pgoff);
+ if (err) {
+- pr_err("VFS (%s): error: unaligned partition for dax\n",
+- sb->s_id);
++ pr_debug("%s: error: unaligned partition for dax\n",
++ bdevname(bdev, buf));
+ return err;
+ }
+
+ dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+ if (!dax_dev) {
+- pr_err("VFS (%s): error: device does not support dax\n",
+- sb->s_id);
++ pr_debug("%s: error: device does not support dax\n",
++ bdevname(bdev, buf));
+ return -EOPNOTSUPP;
+ }
+
+@@ -118,8 +118,8 @@ int __bdev_dax_supported(struct super_bl
+ put_dax(dax_dev);
+
+ if (len < 1) {
+- pr_err("VFS (%s): error: dax access failed (%ld)",
+- sb->s_id, len);
++ pr_debug("%s: error: dax access failed (%ld)\n",
++ bdevname(bdev, buf), len);
+ return len < 0 ? len : -EIO;
+ }
+
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -953,7 +953,7 @@ static int ext2_fill_super(struct super_
+ blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);
+
+ if (sbi->s_mount_opt & EXT2_MOUNT_DAX) {
+- err = bdev_dax_supported(sb, blocksize);
++ err = bdev_dax_supported(sb->s_bdev, blocksize);
+ if (err)
+ goto failed_mount;
+ }
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3770,7 +3770,7 @@ static int ext4_fill_super(struct super_
+ " that may contain inline data");
+ goto failed_mount;
+ }
+- err = bdev_dax_supported(sb, blocksize);
++ err = bdev_dax_supported(sb->s_bdev, blocksize);
+ if (err)
+ goto failed_mount;
+ }
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -1101,7 +1101,8 @@ xfs_ioctl_setattr_dax_invalidate(
+ if (fa->fsx_xflags & FS_XFLAG_DAX) {
+ if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)))
+ return -EINVAL;
+- if (bdev_dax_supported(sb, sb->s_blocksize) < 0)
++ if (bdev_dax_supported(xfs_find_bdev_for_inode(VFS_I(ip)),
++ sb->s_blocksize) < 0)
+ return -EINVAL;
+ }
+
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -1184,6 +1184,30 @@ static const struct inode_operations xfs
+ .update_time = xfs_vn_update_time,
+ };
+
++/* Figure out if this file actually supports DAX. */
++static bool
++xfs_inode_supports_dax(
++ struct xfs_inode *ip)
++{
++ struct xfs_mount *mp = ip->i_mount;
++
++ /* Only supported on non-reflinked files. */
++ if (!S_ISREG(VFS_I(ip)->i_mode) || xfs_is_reflink_inode(ip))
++ return false;
++
++ /* DAX mount option or DAX iflag must be set. */
++ if (!(mp->m_flags & XFS_MOUNT_DAX) &&
++ !(ip->i_d.di_flags2 & XFS_DIFLAG2_DAX))
++ return false;
++
++ /* Block size must match page size */
++ if (mp->m_sb.sb_blocksize != PAGE_SIZE)
++ return false;
++
++ /* Device has to support DAX too. */
++ return xfs_find_daxdev_for_inode(VFS_I(ip)) != NULL;
++}
++
+ STATIC void
+ xfs_diflags_to_iflags(
+ struct inode *inode,
+@@ -1202,11 +1226,7 @@ xfs_diflags_to_iflags(
+ inode->i_flags |= S_SYNC;
+ if (flags & XFS_DIFLAG_NOATIME)
+ inode->i_flags |= S_NOATIME;
+- if (S_ISREG(inode->i_mode) &&
+- ip->i_mount->m_sb.sb_blocksize == PAGE_SIZE &&
+- !xfs_is_reflink_inode(ip) &&
+- (ip->i_mount->m_flags & XFS_MOUNT_DAX ||
+- ip->i_d.di_flags2 & XFS_DIFLAG2_DAX))
++ if (xfs_inode_supports_dax(ip))
+ inode->i_flags |= S_DAX;
+ }
+
+--- a/fs/xfs/xfs_super.c
++++ b/fs/xfs/xfs_super.c
+@@ -1640,11 +1640,17 @@ xfs_fs_fill_super(
+ sb->s_flags |= SB_I_VERSION;
+
+ if (mp->m_flags & XFS_MOUNT_DAX) {
++ int error2 = 0;
++
+ xfs_warn(mp,
+ "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
+
+- error = bdev_dax_supported(sb, sb->s_blocksize);
+- if (error) {
++ error = bdev_dax_supported(mp->m_ddev_targp->bt_bdev,
++ sb->s_blocksize);
++ if (mp->m_rtdev_targp)
++ error2 = bdev_dax_supported(mp->m_rtdev_targp->bt_bdev,
++ sb->s_blocksize);
++ if (error && error2) {
+ xfs_alert(mp,
+ "DAX unsupported by block device. Turning off DAX.");
+ mp->m_flags &= ~XFS_MOUNT_DAX;
+--- a/include/linux/dax.h
++++ b/include/linux/dax.h
+@@ -40,10 +40,10 @@ static inline void put_dax(struct dax_de
+
+ int bdev_dax_pgoff(struct block_device *, sector_t, size_t, pgoff_t *pgoff);
+ #if IS_ENABLED(CONFIG_FS_DAX)
+-int __bdev_dax_supported(struct super_block *sb, int blocksize);
+-static inline int bdev_dax_supported(struct super_block *sb, int blocksize)
++int __bdev_dax_supported(struct block_device *bdev, int blocksize);
++static inline int bdev_dax_supported(struct block_device *bdev, int blocksize)
+ {
+- return __bdev_dax_supported(sb, blocksize);
++ return __bdev_dax_supported(bdev, blocksize);
+ }
+
+ static inline struct dax_device *fs_dax_get_by_host(const char *host)
+@@ -58,7 +58,8 @@ static inline void fs_put_dax(struct dax
+
+ struct dax_device *fs_dax_get_by_bdev(struct block_device *bdev);
+ #else
+-static inline int bdev_dax_supported(struct super_block *sb, int blocksize)
++static inline int bdev_dax_supported(struct block_device *bdev,
++ int blocksize)
+ {
+ return -EOPNOTSUPP;
+ }
--- /dev/null
+From 717adfdaf14704fd3ec7fa2c04520c0723247eac Mon Sep 17 00:00:00 2001
+From: Daniel Rosenberg <drosen@google.com>
+Date: Mon, 2 Jul 2018 16:59:37 -0700
+Subject: HID: debug: check length before copy_to_user()
+
+From: Daniel Rosenberg <drosen@google.com>
+
+commit 717adfdaf14704fd3ec7fa2c04520c0723247eac upstream.
+
+If our length is greater than the size of the buffer, we
+overflow the buffer
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Rosenberg <drosen@google.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-debug.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-debug.c
++++ b/drivers/hid/hid-debug.c
+@@ -1154,6 +1154,8 @@ copy_rest:
+ goto out;
+ if (list->tail > list->head) {
+ len = list->tail - list->head;
++ if (len > count)
++ len = count;
+
+ if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
+ ret = -EFAULT;
+@@ -1163,6 +1165,8 @@ copy_rest:
+ list->head += len;
+ } else {
+ len = HID_DEBUG_BUFSIZE - list->head;
++ if (len > count)
++ len = count;
+
+ if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
+ ret = -EFAULT;
+@@ -1170,7 +1174,9 @@ copy_rest:
+ }
+ list->head = 0;
+ ret += len;
+- goto copy_rest;
++ count -= len;
++ if (count > 0)
++ goto copy_rest;
+ }
+
+ }
--- /dev/null
+From 4f65245f2d178b9cba48350620d76faa4a098841 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Fri, 29 Jun 2018 17:08:44 -0500
+Subject: HID: hiddev: fix potential Spectre v1
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 4f65245f2d178b9cba48350620d76faa4a098841 upstream.
+
+uref->field_index, uref->usage_index, finfo.field_index and cinfo.index can be
+indirectly controlled by user-space, hence leading to a potential exploitation
+of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+drivers/hid/usbhid/hiddev.c:473 hiddev_ioctl_usage() warn: potential spectre issue 'report->field' (local cap)
+drivers/hid/usbhid/hiddev.c:477 hiddev_ioctl_usage() warn: potential spectre issue 'field->usage' (local cap)
+drivers/hid/usbhid/hiddev.c:757 hiddev_ioctl() warn: potential spectre issue 'report->field' (local cap)
+drivers/hid/usbhid/hiddev.c:801 hiddev_ioctl() warn: potential spectre issue 'hid->collection' (local cap)
+
+Fix this by sanitizing such structure fields before using them to index
+report->field, field->usage and hid->collection
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/usbhid/hiddev.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -36,6 +36,7 @@
+ #include <linux/hiddev.h>
+ #include <linux/compat.h>
+ #include <linux/vmalloc.h>
++#include <linux/nospec.h>
+ #include "usbhid.h"
+
+ #ifdef CONFIG_USB_DYNAMIC_MINORS
+@@ -469,10 +470,14 @@ static noinline int hiddev_ioctl_usage(s
+
+ if (uref->field_index >= report->maxfield)
+ goto inval;
++ uref->field_index = array_index_nospec(uref->field_index,
++ report->maxfield);
+
+ field = report->field[uref->field_index];
+ if (uref->usage_index >= field->maxusage)
+ goto inval;
++ uref->usage_index = array_index_nospec(uref->usage_index,
++ field->maxusage);
+
+ uref->usage_code = field->usage[uref->usage_index].hid;
+
+@@ -499,6 +504,8 @@ static noinline int hiddev_ioctl_usage(s
+
+ if (uref->field_index >= report->maxfield)
+ goto inval;
++ uref->field_index = array_index_nospec(uref->field_index,
++ report->maxfield);
+
+ field = report->field[uref->field_index];
+
+@@ -753,6 +760,8 @@ static long hiddev_ioctl(struct file *fi
+
+ if (finfo.field_index >= report->maxfield)
+ break;
++ finfo.field_index = array_index_nospec(finfo.field_index,
++ report->maxfield);
+
+ field = report->field[finfo.field_index];
+ memset(&finfo, 0, sizeof(finfo));
+@@ -797,6 +806,8 @@ static long hiddev_ioctl(struct file *fi
+
+ if (cinfo.index >= hid->maxcollection)
+ break;
++ cinfo.index = array_index_nospec(cinfo.index,
++ hid->maxcollection);
+
+ cinfo.type = hid->collection[cinfo.index].type;
+ cinfo.usage = hid->collection[cinfo.index].usage;
--- /dev/null
+From ef6eaf27274c0351f7059163918f3795da13199c Mon Sep 17 00:00:00 2001
+From: Jason Andryuk <jandryuk@gmail.com>
+Date: Fri, 22 Jun 2018 12:25:49 -0400
+Subject: HID: i2c-hid: Fix "incomplete report" noise
+
+From: Jason Andryuk <jandryuk@gmail.com>
+
+commit ef6eaf27274c0351f7059163918f3795da13199c upstream.
+
+Commit ac75a041048b ("HID: i2c-hid: fix size check and type usage") started
+writing messages when the ret_size is <= 2 from i2c_master_recv. However, my
+device i2c-DLL07D1 returns 2 for a short period of time (~0.5s) after I stop
+moving the pointing stick or touchpad. It varies, but you get ~50 messages
+each time which spams the log hard.
+
+[ 95.925055] i2c_hid i2c-DLL07D1:01: i2c_hid_get_input: incomplete report (83/2)
+
+This has also been observed with a i2c-ALP0017.
+
+[ 1781.266353] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
+
+Only print the message when ret_size is totally invalid and less than 2 to cut
+down on the log spam.
+
+Fixes: ac75a041048b ("HID: i2c-hid: fix size check and type usage")
+Reported-by: John Smith <john-s-84@gmx.net>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/i2c-hid/i2c-hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -476,7 +476,7 @@ static void i2c_hid_get_input(struct i2c
+ return;
+ }
+
+- if ((ret_size > size) || (ret_size <= 2)) {
++ if ((ret_size > size) || (ret_size < 2)) {
+ dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
+ __func__, size, ret_size);
+ return;
--- /dev/null
+From 10d94ff4d558b96bfc4f55bb0051ae4d938246fe Mon Sep 17 00:00:00 2001
+From: Rakib Mullick <rakib.mullick@gmail.com>
+Date: Wed, 1 Nov 2017 10:14:51 +0600
+Subject: irq/core: Fix boot crash when the irqaffinity= boot parameter is passed on CPUMASK_OFFSTACK=y kernels(v1)
+
+From: Rakib Mullick <rakib.mullick@gmail.com>
+
+commit 10d94ff4d558b96bfc4f55bb0051ae4d938246fe upstream.
+
+When the irqaffinity= kernel parameter is passed in a CPUMASK_OFFSTACK=y
+kernel, it fails to boot, because zalloc_cpumask_var() cannot be used before
+initializing the slab allocator to allocate a cpumask.
+
+So, use alloc_bootmem_cpumask_var() instead.
+
+Also do some cleanups while at it: in init_irq_default_affinity() remove
+an #ifdef via using cpumask_available().
+
+Signed-off-by: Rakib Mullick <rakib.mullick@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20171026045800.27087-1-rakib.mullick@gmail.com
+Link: http://lkml.kernel.org/r/20171101041451.12581-1-rakib.mullick@gmail.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Janne Huttunen <janne.huttunen@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/irqdesc.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -27,7 +27,7 @@ static struct lock_class_key irq_desc_lo
+ #if defined(CONFIG_SMP)
+ static int __init irq_affinity_setup(char *str)
+ {
+- zalloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT);
++ alloc_bootmem_cpumask_var(&irq_default_affinity);
+ cpulist_parse(str, irq_default_affinity);
+ /*
+ * Set at least the boot cpu. We don't want to end up with
+@@ -40,10 +40,8 @@ __setup("irqaffinity=", irq_affinity_set
+
+ static void __init init_irq_default_affinity(void)
+ {
+-#ifdef CONFIG_CPUMASK_OFFSTACK
+- if (!irq_default_affinity)
++ if (!cpumask_available(irq_default_affinity))
+ zalloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT);
+-#endif
+ if (cpumask_empty(irq_default_affinity))
+ cpumask_setall(irq_default_affinity);
+ }
--- /dev/null
+From 9564a8cf422d7b58f6e857e3546d346fa970191e Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Sun, 8 Apr 2018 23:35:28 +0200
+Subject: Kbuild: fix # escaping in .cmd files for future Make
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+commit 9564a8cf422d7b58f6e857e3546d346fa970191e upstream.
+
+I tried building using a freshly built Make (4.2.1-69-g8a731d1), but
+already the objtool build broke with
+
+orc_dump.c: In function ‘orc_dump’:
+orc_dump.c:106:2: error: ‘elf_getshnum’ is deprecated [-Werror=deprecated-declarations]
+ if (elf_getshdrnum(elf, &nr_sections)) {
+
+Turns out that with that new Make, the backslash was not removed, so cpp
+didn't see a #include directive, grep found nothing, and
+-DLIBELF_USE_DEPRECATED was wrongly put in CFLAGS.
+
+Now, that new Make behaviour is documented in their NEWS file:
+
+ * WARNING: Backward-incompatibility!
+ Number signs (#) appearing inside a macro reference or function invocation
+ no longer introduce comments and should not be escaped with backslashes:
+ thus a call such as:
+ foo := $(shell echo '#')
+ is legal. Previously the number sign needed to be escaped, for example:
+ foo := $(shell echo '\#')
+ Now this latter will resolve to "\#". If you want to write makefiles
+ portable to both versions, assign the number sign to a variable:
+ C := \#
+ foo := $(shell echo '$C')
+ This was claimed to be fixed in 3.81, but wasn't, for some reason.
+ To detect this change search for 'nocomment' in the .FEATURES variable.
+
+This also fixes up the two make-cmd instances to replace # with $(pound)
+rather than with \#. There might very well be other places that need
+similar fixup in preparation for whatever future Make release contains
+the above change, but at least this builds an x86_64 defconfig with the
+new make.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197847
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ scripts/Kbuild.include | 5 +++--
+ tools/build/Build.include | 5 +++--
+ tools/objtool/Makefile | 2 +-
+ tools/scripts/Makefile.include | 2 ++
+ 4 files changed, 9 insertions(+), 5 deletions(-)
+
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -8,6 +8,7 @@ squote := '
+ empty :=
+ space := $(empty) $(empty)
+ space_escape := _-_SPACE_-_
++pound := \#
+
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -251,11 +252,11 @@ endif
+
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+
+ # Find any prerequisites that is newer than target or that does not exist.
+ # PHONY targets skipped in both cases.
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -12,6 +12,7 @@
+ # Convenient variables
+ comma := ,
+ squote := '
++pound := \#
+
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -43,11 +44,11 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\
+ ###
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+
+ ###
+ # Find any prerequisites that is newer than target or that does not exist.
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -35,7 +35,7 @@ CFLAGS += -Wall -Werror $(WARNINGS) -f
+ LDFLAGS += -lelf $(LIBSUBCMD)
+
+ # Allow old libelf to be used:
+-elfshdr := $(shell echo '\#include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
++elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
+ CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED)
+
+ AWK = awk
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -101,3 +101,5 @@ ifneq ($(silent),1)
+ QUIET_INSTALL = @printf ' INSTALL %s\n' $1;
+ endif
+ endif
++
++pound := \#
--- /dev/null
+From 3ee9bc12342cf546313d300808ff47d7dbb8e7db Mon Sep 17 00:00:00 2001
+From: Brad Love <brad@nextdimension.cc>
+Date: Tue, 6 Mar 2018 14:15:34 -0500
+Subject: media: cx25840: Use subdev host data for PLL override
+
+From: Brad Love <brad@nextdimension.cc>
+
+commit 3ee9bc12342cf546313d300808ff47d7dbb8e7db upstream.
+
+The cx25840 driver currently configures 885, 887, and 888 using
+default divisors for each chip. This check to see if the cx23885
+driver has passed the cx25840 a non-default clock rate for a
+specific chip. If a cx23885 board has left clk_freq at 0, the
+clock default values will be used to configure the PLLs.
+
+This patch only has effect on 888 boards who set clk_freq to 25M.
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/cx25840/cx25840-core.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/cx25840/cx25840-core.c
++++ b/drivers/media/i2c/cx25840/cx25840-core.c
+@@ -463,8 +463,13 @@ static void cx23885_initialize(struct i2
+ {
+ DEFINE_WAIT(wait);
+ struct cx25840_state *state = to_state(i2c_get_clientdata(client));
++ u32 clk_freq = 0;
+ struct workqueue_struct *q;
+
++ /* cx23885 sets hostdata to clk_freq pointer */
++ if (v4l2_get_subdev_hostdata(&state->sd))
++ clk_freq = *((u32 *)v4l2_get_subdev_hostdata(&state->sd));
++
+ /*
+ * Come out of digital power down
+ * The CX23888, at least, needs this, otherwise registers aside from
+@@ -500,8 +505,13 @@ static void cx23885_initialize(struct i2
+ * 50.0 MHz * (0xb + 0xe8ba26/0x2000000)/4 = 5 * 28.636363 MHz
+ * 572.73 MHz before post divide
+ */
+- /* HVR1850 or 50MHz xtal */
+- cx25840_write(client, 0x2, 0x71);
++ if (clk_freq == 25000000) {
++ /* 888/ImpactVCBe or 25Mhz xtal */
++ ; /* nothing to do */
++ } else {
++ /* HVR1850 or 50MHz xtal */
++ cx25840_write(client, 0x2, 0x71);
++ }
+ cx25840_write4(client, 0x11c, 0x01d1744c);
+ cx25840_write4(client, 0x118, 0x00000416);
+ cx25840_write4(client, 0x404, 0x0010253e);
+@@ -544,9 +554,15 @@ static void cx23885_initialize(struct i2
+ /* HVR1850 */
+ switch (state->id) {
+ case CX23888_AV:
+- /* 888/HVR1250 specific */
+- cx25840_write4(client, 0x10c, 0x13333333);
+- cx25840_write4(client, 0x108, 0x00000515);
++ if (clk_freq == 25000000) {
++ /* 888/ImpactVCBe or 25MHz xtal */
++ cx25840_write4(client, 0x10c, 0x01b6db7b);
++ cx25840_write4(client, 0x108, 0x00000512);
++ } else {
++ /* 888/HVR1250 or 50MHz xtal */
++ cx25840_write4(client, 0x10c, 0x13333333);
++ cx25840_write4(client, 0x108, 0x00000515);
++ }
+ break;
+ default:
+ cx25840_write4(client, 0x10c, 0x002be2c9);
+@@ -576,7 +592,7 @@ static void cx23885_initialize(struct i2
+ * 368.64 MHz before post divide
+ * 122.88 MHz / 0xa = 12.288 MHz
+ */
+- /* HVR1850 or 50MHz xtal */
++ /* HVR1850 or 50MHz xtal or 25MHz xtal */
+ cx25840_write4(client, 0x114, 0x017dbf48);
+ cx25840_write4(client, 0x110, 0x000a030e);
+ break;
--- /dev/null
+From 03703ed1debf777ea845aa9b50ba2e80a5e7dd3c Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Fri, 2 Feb 2018 05:08:59 -0500
+Subject: media: vb2: core: Finish buffers at the end of the stream
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit 03703ed1debf777ea845aa9b50ba2e80a5e7dd3c upstream.
+
+If buffers were prepared or queued and the buffers were released without
+starting the queue, the finish mem op (corresponding to the prepare mem
+op) was never called to the buffers.
+
+Before commit a136f59c0a1f there was no need to do this as in such a case
+the prepare mem op had not been called yet. Address the problem by
+explicitly calling finish mem op when the queue is stopped if the buffer
+is in either prepared or queued state.
+
+Fixes: a136f59c0a1f ("[media] vb2: Move buffer cache synchronisation to prepare from queue")
+
+Cc: stable@vger.kernel.org # for v4.13 and up
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -1689,6 +1689,15 @@ static void __vb2_queue_cancel(struct vb
+ for (i = 0; i < q->num_buffers; ++i) {
+ struct vb2_buffer *vb = q->bufs[i];
+
++ if (vb->state == VB2_BUF_STATE_PREPARED ||
++ vb->state == VB2_BUF_STATE_QUEUED) {
++ unsigned int plane;
++
++ for (plane = 0; plane < vb->num_planes; ++plane)
++ call_void_memop(vb, finish,
++ vb->planes[plane].mem_priv);
++ }
++
+ if (vb->state != VB2_BUF_STATE_DEQUEUED) {
+ vb->state = VB2_BUF_STATE_PREPARED;
+ call_void_vb_qop(vb, buf_finish, vb);
--- /dev/null
+From 31286a8484a85e8b4e91ddb0f5415aee8a416827 Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Thu, 5 Apr 2018 16:23:05 -0700
+Subject: mm: hwpoison: disable memory error handling on 1GB hugepage
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit 31286a8484a85e8b4e91ddb0f5415aee8a416827 upstream.
+
+Recently the following BUG was reported:
+
+ Injecting memory failure for pfn 0x3c0000 at process virtual address 0x7fe300000000
+ Memory failure: 0x3c0000: recovery action for huge page: Recovered
+ BUG: unable to handle kernel paging request at ffff8dfcc0003000
+ IP: gup_pgd_range+0x1f0/0xc20
+ PGD 17ae72067 P4D 17ae72067 PUD 0
+ Oops: 0000 [#1] SMP PTI
+ ...
+ CPU: 3 PID: 5467 Comm: hugetlb_1gb Not tainted 4.15.0-rc8-mm1-abc+ #3
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014
+
+You can easily reproduce this by calling madvise(MADV_HWPOISON) twice on
+a 1GB hugepage. This happens because get_user_pages_fast() is not aware
+of a migration entry on pud that was created in the 1st madvise() event.
+
+I think that conversion to pud-aligned migration entry is working, but
+other MM code walking over page table isn't prepared for it. We need
+some time and effort to make all this work properly, so this patch
+avoids the reported bug by just disabling error handling for 1GB
+hugepage.
+
+[n-horiguchi@ah.jp.nec.com: v2]
+ Link: http://lkml.kernel.org/r/1517284444-18149-1-git-send-email-n-horiguchi@ah.jp.nec.com
+Link: http://lkml.kernel.org/r/1517207283-15769-1-git-send-email-n-horiguchi@ah.jp.nec.com
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Acked-by: Punit Agrawal <punit.agrawal@arm.com>
+Tested-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Anshuman Khandual <khandual@linux.vnet.ibm.com>
+Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/mm.h | 1 +
+ mm/memory-failure.c | 16 ++++++++++++++++
+ 2 files changed, 17 insertions(+)
+
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2549,6 +2549,7 @@ enum mf_action_page_type {
+ MF_MSG_POISONED_HUGE,
+ MF_MSG_HUGE,
+ MF_MSG_FREE_HUGE,
++ MF_MSG_NON_PMD_HUGE,
+ MF_MSG_UNMAP_FAILED,
+ MF_MSG_DIRTY_SWAPCACHE,
+ MF_MSG_CLEAN_SWAPCACHE,
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -508,6 +508,7 @@ static const char * const action_page_ty
+ [MF_MSG_POISONED_HUGE] = "huge page already hardware poisoned",
+ [MF_MSG_HUGE] = "huge page",
+ [MF_MSG_FREE_HUGE] = "free huge page",
++ [MF_MSG_NON_PMD_HUGE] = "non-pmd-sized huge page",
+ [MF_MSG_UNMAP_FAILED] = "unmapping failed page",
+ [MF_MSG_DIRTY_SWAPCACHE] = "dirty swapcache page",
+ [MF_MSG_CLEAN_SWAPCACHE] = "clean swapcache page",
+@@ -1090,6 +1091,21 @@ static int memory_failure_hugetlb(unsign
+ return 0;
+ }
+
++ /*
++ * TODO: hwpoison for pud-sized hugetlb doesn't work right now, so
++ * simply disable it. In order to make it work properly, we need
++ * make sure that:
++ * - conversion of a pud that maps an error hugetlb into hwpoison
++ * entry properly works, and
++ * - other mm code walking over page table is aware of pud-aligned
++ * hwpoison entries.
++ */
++ if (huge_page_size(page_hstate(head)) > PMD_SIZE) {
++ action_result(pfn, MF_MSG_NON_PMD_HUGE, MF_IGNORED);
++ res = -EBUSY;
++ goto out;
++ }
++
+ if (!hwpoison_user_mappings(p, pfn, trapno, flags, &head)) {
+ action_result(pfn, MF_MSG_UNMAP_FAILED, MF_IGNORED);
+ res = -EBUSY;
--- /dev/null
+From 3f77f244d8ec28e3a0a81240ffac7d626390060c Mon Sep 17 00:00:00 2001
+From: Martin Kaiser <martin@kaiser.cx>
+Date: Mon, 18 Jun 2018 22:41:03 +0200
+Subject: mtd: rawnand: mxc: set spare area size register explicitly
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+commit 3f77f244d8ec28e3a0a81240ffac7d626390060c upstream.
+
+The v21 version of the NAND flash controller contains a Spare Area Size
+Register (SPAS) at offset 0x10. Its setting defaults to the maximum
+spare area size of 218 bytes. The size that is set in this register is
+used by the controller when it calculates the ECC bytes internally in
+hardware.
+
+Usually, this register is updated from settings in the IIM fuses when
+the system is booting from NAND flash. For other boot media, however,
+the SPAS register remains at the default setting, which may not work for
+the particular flash chip on the board. The same goes for flash chips
+whose configuration cannot be set in the IIM fuses (e.g. chips with 2k
+sector size and 128 bytes spare area size can't be configured in the IIM
+fuses on imx25 systems).
+
+Set the SPAS register explicitly during the preset operation. Derive the
+register value from mtd->oobsize that was detected during probe by
+decoding the flash chip's ID bytes.
+
+While at it, rename the define for the spare area register's offset to
+NFC_V21_RSLTSPARE_AREA. The register at offset 0x10 on v1 controllers is
+different from the register on v21 controllers.
+
+Fixes: d484018 ("mtd: mxc_nand: set NFC registers after reset")
+Cc: stable@vger.kernel.org
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/mtd/nand/mxc_nand.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/mxc_nand.c
++++ b/drivers/mtd/nand/mxc_nand.c
+@@ -48,7 +48,7 @@
+ #define NFC_V1_V2_CONFIG (host->regs + 0x0a)
+ #define NFC_V1_V2_ECC_STATUS_RESULT (host->regs + 0x0c)
+ #define NFC_V1_V2_RSLTMAIN_AREA (host->regs + 0x0e)
+-#define NFC_V1_V2_RSLTSPARE_AREA (host->regs + 0x10)
++#define NFC_V21_RSLTSPARE_AREA (host->regs + 0x10)
+ #define NFC_V1_V2_WRPROT (host->regs + 0x12)
+ #define NFC_V1_UNLOCKSTART_BLKADDR (host->regs + 0x14)
+ #define NFC_V1_UNLOCKEND_BLKADDR (host->regs + 0x16)
+@@ -1119,6 +1119,9 @@ static void preset_v2(struct mtd_info *m
+ writew(config1, NFC_V1_V2_CONFIG1);
+ /* preset operation */
+
++ /* spare area size in 16-bit half-words */
++ writew(mtd->oobsize / 2, NFC_V21_RSLTSPARE_AREA);
++
+ /* Unlock the internal RAM Buffer */
+ writew(0x2, NFC_V1_V2_CONFIG);
+
--- /dev/null
+From 529fd09a22f7dd25ef7f0b1ce998da0ed0b868ac Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 10 Jul 2018 16:01:30 +0200
+Subject: [PATCH] Revert "dpaa_eth: fix error in dpaa_remove()"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit 5bbb99d2fde047df596379be6c58e265e2ddbe1f which is
+commit 88075256ee817041d68c2387f29065b5cb2b342a upstream.
+
+Jiri writes that this was an incorrect fix, and Madalin-cristian says it
+was fixed differently in a later patch. So just revert this from
+4.14.y.
+
+Reported-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Madalin Bucur <madalin.bucur@nxp.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2863,7 +2863,7 @@ static int dpaa_remove(struct platform_d
+ struct device *dev;
+ int err;
+
+- dev = pdev->dev.parent;
++ dev = &pdev->dev;
+ net_dev = dev_get_drvdata(dev);
+
+ priv = netdev_priv(net_dev);
ext4-add-more-inode-number-paranoia-checks.patch
ext4-add-more-mount-time-checks-of-the-superblock.patch
ext4-check-superblock-mapped-prior-to-committing.patch
+block-factor-out-__blkdev_issue_zero_pages.patch
+block-cope-with-write-zeroes-failing-in-blkdev_issue_zeroout.patch
+hid-i2c-hid-fix-incomplete-report-noise.patch
+hid-hiddev-fix-potential-spectre-v1.patch
+hid-debug-check-length-before-copy_to_user.patch
+irq-core-fix-boot-crash-when-the-irqaffinity-boot-parameter-is-passed-on-cpumask_offstack-y-kernels-v1.patch
+mm-hwpoison-disable-memory-error-handling-on-1gb-hugepage.patch
+media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch
+f2fs-truncate-preallocated-blocks-in-error-case.patch
+revert-dpaa_eth-fix-error-in-dpaa_remove.patch
+kbuild-fix-escaping-in-.cmd-files-for-future-make.patch
+media-cx25840-use-subdev-host-data-for-pll-override.patch
+mtd-rawnand-mxc-set-spare-area-size-register-explicitly.patch
+fs-allow-per-device-dax-status-checking-for-filesystems.patch
+dax-change-bdev_dax_supported-to-support-boolean-returns.patch
+dax-check-for-queue_flag_dax-in-bdev_dax_supported.patch
+dm-set-queue_flag_dax-accordingly-in-dm_table_set_restrictions.patch
+dm-prevent-dax-mounts-if-not-supported.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
